libkrun
microvmvmmopen sourceAn embeddable, in-process exposed as a C library, the engine under krunvm, Podman+krun, smolvm, and microsandbox.
libkrun is a purpose-built, embeddable Virtual Machine Monitor delivered as a C library rather than a standalone binary. It integrates a with the minimum emulated devices needed and boots its own fixed kernel (libkrunfw); 'become a generic ' is an explicit non-goal. It runs on KVM (Linux), HVF (macOS), and WHP (Windows), giving cross-platform with a small device surface. Because it links in-process, it has no separate binary for a Firecracker-style to wrap.
Strengths
- Cross-platform microVMs: KVM (Linux), HVF (macOS), WHP (Windows)
- Minimal emulated device set and a fixed kernel, small attack surface
- Embeddable C library, the engine under krunvm, Podman+krun, smolvm, microsandbox
Limitations
- Embeddable, in-process VMM that installs no seccomp filter of its own, the second wall is the embedder's responsibility
- Because the VMM is linked in-process, a VMM bug lands with the host process's authority
- A library, not an end-user tool, you use it through krunvm/Podman/microsandbox/smolvm
VMM second wall
VMM second wall: noneinstalls no seccomp of its own; the second wall is the embedder's responsibility.
The second wall confines the VMM itself, so a compromised device backend can't own the host. It's separate from the hardware boundary every microVM already has. The two walls, explained.